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REMARKS 

The Examiner has rejected Claims 1-41 under 35 U.S.C 101 as being directed to 
non-statutory subject matter. Applicant respectfully asserts that such rejections are 
avoided in view of the clarifications made to each of the independent claims. 

The Examiner has rejected Claims 1-41 under 35 U.S.C. 103(a) as being 
unpatentable over Kephart (U.S. Patent No. 6,732,149) in view of Nachenberg (U.S. 
Patent No. 6,02 1 ,5 1 0). Applicant respectfully disagrees with such rejection, especially in 
view of the amendments made hereinabove to each of the independent claims. 
Specifically, applicant has amended independent Claims 1, 10, 35, and 38 to include the 
subject matter of dependent Claim 7 et al. In addition, applicant has amended 
independent Claims 20 and 27 to include the subject matter of dependent Claim 22 et al. 

With respect to independent Claims 20 and 27, the Examiner has relied on the 
following excerpt from Nachenberg to make a prior art showing of applicant's claimed 
"parsing module parsing the field values from each field in the header and the message 
content from the body" (see this or similar, but not identical language in Claims 20 and 
27). 

W A parser is first needed, because the parser can distinguish 
between critical portions of a file, e.g., distinguish between 
executable code and data. After the parser has determined what 
are the critical portions of the file for purposes of antivirus 
protection, a hasher can be built to create the hash value based 
upon the critical portions of the file." (Col. 2, lines 56-63) 

Applicant respectfully asserts that the above excerpt fails to teach parsing "field 
values from each field in the header and the message content from the body" (Claims 20 
and 27) as claimed by applicant, since such excerpt only discloses a 
"parser... distinguishing] between critical portions of a file." Clearly, critical portions, as 
in Nachenberg, to do not meet applicant's specifically claimed field values and message 
content. 
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With respect to independent Claims 1 and 10, the Examiner has relied on the 
following excerpts from Kephart to make a prior art showing of applicant's claimed 
"checksum module storing the checksum in an information file associated with the 
incoming message in a transient message store" (see this or similar, but not identical 
language in the foregoing claims). 

"...adding the signature to a signature database-" (Col. 5, lines 
52-53} 

tt The signature information preferably includes a signature from 
the at least one specific electronic message. The storing step 
can include the step of storing the signature in at least one 
signature database." (Col. 6, lines 23-26) 

Applicant respectfully asserts that simply storing a signature, as in Kephart, does 
not rise to the level of specificity of applicant's claimed checksum . In addition, Kephart 
teaches a signature that is merely stored in a signature database , whereas applicant claims 
"storing the checksum in an information file associated w ith the incoming message in a 
transient message store " Thus, only applicant teaches and claims a "checksum [that is 
stored] in an information file associated with the incoming message in a transient 
message store," as claimed 

Also with respect to independent Claims 1 and 1 0, the Examiner has relied on 
Col. 6, line 57-Col. 7, line 24 in Kephart to make a prior art showing of applicant's 
claimed "recording the checksum corresponding to each infected message content and an 
infection indicator." However, after carefully reading such excerpt, it is clear that the 
only "stored checksum" in Kephart relates to "comparing a computed checksum [of a 
region of the specific electronic message] with a stored checksum" (see specifically Col. 
7, lines 17-22). Therefore, the stored checksum in Kephart is not disclosed to 
"[correspond] to each infected message content," as claimed by applicant, but is instead 
only compared against a computed checksum that corresponds to the electronic message. 
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With respect to independent Claims 20 and 27, the Examiner has relied on item 
616 of Figure 6 and item 418 of Figure 4 to make a prior art showing of applicant's 
claimed Update module updating the message digest corresponding to each infected 
message content with an infection indicator" (see this or similar, but not identical 
language in each of the forgoing claims). Applicant respectfully asserts that such items 
relied on by the Examiner merely relate to updating local signatu re databases and a 
master signature database "with information about the new instance of the undesirable 
message" (Col. 16, lines 39-40), whereas applicant specifically claims updating a 
" message digest corresponding to each infected message content with an infection 
indicator" (emphasis added). Clearly, a signature database, as in Kephart, does not meet 
applicant's claimed "message digest corresponding to each infected message content." 

With respect to independent Claims 35 and 28, the Examiner has failed to even 
consider applicant's claimed "checksum module calculating and storing a checksum over 
the message packet content stored in the body of the incom ing message packet" or "an 
antivirus scanner scanning an incoming message if the at least one of the check sum and 
the digest have not been previously stored with an infection indicator indicating a 
presence of at least one of a computer virus and malware " (see this or similar, but not 
identical language in each of the foregoing claims-emphasis added). 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaech 947 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.1991). 
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Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. Nevertheless, despite 
such paramount deficiencies and in the spirit of expediting the prosecution of the present 
application, applicant has substantially incorporated the subject matter of dependent 
Claim 7 et al. into independent claims 1, 10, 35, and 38. Further, applicant has 
substantially incorporated the subject matter of dependent Claim 22 et al. into 
independent Claims 20 and 27, 

With respect to the subject matter of dependent Claim 7 et al. (now incorporated 
into the independent claims noted above), the Examiner has failed to specifically address 
applicant's claimed technique u wherein the checksum is calculated as a running 
checksum on a line-by-line basis as the incoming message is received" (see this or 
similar, but not identical language in each of the foregoing claims). Applicant notes that 
the excerpts in Kephart relied on by the Examiner simply teach deleting or altering the 
appearance of a message (Col. 16, lines 22-23), updating a master signature database with 
information about a new instance of an undesirable message (item 616 of Figure 6) and 
comparing a computed checksum with a stored checksum (Col. 7, lines 20-22). Thus, 
such excerpts clearly fail to meet applicant's specific claim language, namely 
"[calculating] the checksum. . .as a running checksum on a line-by-line basis as the 
incoming message is received." 

With respect to the subject matter of Claim 22 et al. (now incorporated into the 
independent claims noted above), the Examiner has relied on Col. 5, lines 49-53, Figure 3 
and Col. 6, lines 62-64 in Kephart to make a prior art showing of applicant's claimed 
"maintaining a set of digests, each comprising the message digest and the infection 
indicator corresponding to each infected message content" (see this or similar, but not 
identical language in each of the foregoing claims). Applicant respectfully asserts that 
such excerpts merely disclose labeling a message as undesirable, and not "a set of digests, 
each comprising the message digest and the infection indicator corresponding to each 
infected message content," as claimed by applicant (emphasis added). 
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A notice of allowance or a specific prior art showing of all of applicant's claim 
limitations, in combination with the remaining claim elements, is respectfully requested. 

Hie Examiner's rejections are also deficient with respect to the dependent claims, 
since such rejections also do not meet each and every element of the prima facie case. 
For example, with respect to dependent Claim 3 et ah, the Examiner has relied on Col. 5, 
lines 49-57, Col. 6, lines 10-12, Col. 7, lines 16-24 in Kephart and Figure 1 in 
Nachenberg to make a prior art showing of applicant's claimed tc table of entries, each 
comprising the checksum and the infection indicator corresponding to each infected 
message content." 

Applicant respectfully asserts that the excerpts in Kephart do not teach any sort of 
"table of entries." In addition, Kephart only teaches "labeling the message as 
undesirable" (emphasis added), but not a table of entries comprising in part an infection 
indicator, in the context claimed by applicant. Furthermore, Figure 1 in Nachenberg does 
not show a table, but rather merely depicts hash values in memory (RAM and disk). 
Thus, clearly applicant's claim language has not been met by the combination of 
references. 

The Examiner has also rejected dependent Claim 5 et al. under Kephart' s 
teachings of deleting or altering the appearance of a message (Col. 16, lines 22-23), 
updating a master signature database with information about a new instance of an 
undesirable message (item 616 of Figure 6), and comparing a computed checksum with a 
stored checksum (Col. 7, lines 20-22). Again, such excerpts do not meet applicant's 
specifically claimed "replacing entries in the table using a least-recently-used 
replacement algorithm." 

Since at least the third element of the prima facie case of obviousness has not 
been met, a notice of allowance or a specific prior art showing of all of the claim 
limitations, in the context of the remaining elements, is respectfully requested. 
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Still yet, applicant brings to the Examiner's attention the subject matter of new 
Claims 42-44 below, which are added for full consideration: 

"wherein the incoming message is not scanned by the antivirus scanner if 
the checksum of the incoming message matches the checksum of one such entry 
with one such infection identifier" (see Claim 42); 

"wherein the field values include a subject value" (see Claim 43); and 

"wherein the message content only includes scripted portions in an 
Hypertext Markup Language (HTML) incoming message" (see Claim 44). 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5 100. The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P392/01. 088,01). 



P.O. Box 721120 

San Jose, CA 95172-4120 

408-505-5100 
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